From 7f37c05b9d3f1f26c60383d8c32f4a60ec542351 Mon Sep 17 00:00:00 2001
From: Malcolm Nixon <Malcolm.Nixon@hiarc.inc>
Date: Fri, 24 Jul 2026 20:59:58 -0400
Subject: [PATCH] chore: exclude generated code and documented broad catches
 from CodeQL

- Add paths-ignore for obj/bin build output to .github/codeql-config.yml.
- Exclude cs/missed-ternary-operator for xUnit-generated entry-point files
  under obj/, which cannot be hand-modified.
- Exclude cs/catch-of-all-exceptions for 7 files whose broad catches were
  already reviewed and documented as intentional UI event-handler/
  drag-drop/best-effort boundaries in the prior CodeQL cleanup (narrowing
  them would contradict their documented never-crash contracts). Mirrors
  the established pattern in ApiMark's .github/codeql-config.yml.
- Fix xUnit2032 in DockTests.cs: Assert.IsAssignableFrom -> Assert.IsType
  with exactMatch: false (functionally identical, clearer intent).

Validated: dotnet build (0 warnings/errors), build.ps1 -Test (290/290
passed), dotnet reqstream --lint (clean). Reviewed via a code-review agent
which confirmed all excluded catch sites are the documented intentional
ones with no mixed/undocumented sites.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/codeql-config.yml          | 27 +++++++++++++++++++++++++++
 test/OtsSoftwareTests/DockTests.cs |  2 +-
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/.github/codeql-config.yml b/.github/codeql-config.yml
index ca3e447..cb46c1f 100644
--- a/.github/codeql-config.yml
+++ b/.github/codeql-config.yml
@@ -2,3 +2,30 @@
 # CodeQL configuration for SysML2Workbench
 
 name: "SysML2Workbench CodeQL Config"
+# Globally ignore build output and generated files
+paths-ignore:
+  - '**/obj/**'
+  - '**/bin/**'
+# Query filters to disable specific queries for certain paths
+query-filters:
+  # Suppress warnings in xUnit-generated entry-point files under obj/ - these are
+  # generated code that cannot be hand-modified and do not reflect authored design.
+  - exclude:
+      id: cs/missed-ternary-operator
+    paths: ['**/obj/**/*.cs']
+  # Suppress warnings for intentionally-broad catch-of-all-exceptions boundaries.
+  # Each of these is a UI event-handler / drag-drop / best-effort teardown boundary
+  # that must report failure (e.g. via a status message) rather than let any
+  # exception type escape and crash the application - narrowing the catch type
+  # would be behaviorally wrong. Each site carries an explanatory comment; see
+  # .github/standards/coding-principles.md for the broad-catch review policy.
+  - exclude:
+      id: cs/catch-of-all-exceptions
+    paths:
+      - src/DemaConsulting.SysML2Workbench/AppShellSubsystem/PredefinedViewsToolViewModel.cs
+      - src/DemaConsulting.SysML2Workbench/AppShellSubsystem/MainWindowView.axaml.cs
+      - src/DemaConsulting.SysML2Workbench/AppShellSubsystem/SourceTextDocumentView.axaml.cs
+      - src/DemaConsulting.SysML2Workbench/AppShellSubsystem/ViewBuilderDialogViewModel.cs
+      - src/DemaConsulting.SysML2Workbench/AppShellSubsystem/WorkspacePanelToolView.axaml.cs
+      - src/DemaConsulting.SysML2Workbench/AppShellSubsystem/WorkspacePanelToolViewModel.cs
+      - test/DemaConsulting.SysML2Workbench.IntegrationTests/AppiumTestBase.cs
diff --git a/test/OtsSoftwareTests/DockTests.cs b/test/OtsSoftwareTests/DockTests.cs
index 81f6062..a1fbda4 100644
--- a/test/OtsSoftwareTests/DockTests.cs
+++ b/test/OtsSoftwareTests/DockTests.cs
@@ -138,7 +138,7 @@ public void RestoreDockable_ReopensClosedToolInOriginalDock()
         };
         window.Show();
 
-        var originalOwner = Assert.IsAssignableFrom<IToolDock>(predefinedViewsViewModel.Owner);
+        var originalOwner = Assert.IsType<IToolDock>(predefinedViewsViewModel.Owner, exactMatch: false);
         Assert.Contains(predefinedViewsViewModel, originalOwner.VisibleDockables!);
 
         // Act - close the panel through the same public API Dock's own chrome invokes.